The bill, formally titled the Online Safety Amendment (Digital Duty of Care) Bill 2026, was introduced to Parliament in October by Communications Minister Anika Wells, who described its intent as a safety net upstream. The legislation would extensively amend the Online Safety Act 2001 to introduce a digital duty of care and strengthen the capacity of the eSafety Commissioner to regulate online services, content, and conduct [2]. Penalties for breaching the law can reach $109.2 million, and the Senate committee is scheduled to hear submissions on Nov. 9 and 10 before reporting by November 20 [1][3].
Senator Sarah Henderson of the Liberal Party called the proposal mass surveillance of people's emails during the hearing, according to testimony.
Rachel Lord, YouTube's senior manager of government affairs and public policy, told the committee that one provision of the bill covering any online service where a child could foreseeably encounter pornography or fetish material lacks an exemption for email or messaging. She said the provision should be limited to those services with a sole or predominant purpose of disseminating pornography, to make that a more targeted and proportionate measure [1].
When Senator Henderson asked whether Google had warned that Gmail and Google Drive would face age checks and scanning of private emails, messages, and files, Lord replied, Correct. Lord also said privacy had been listed as a compliance factor in a September draft but has since been removed, and that the latest version means there are no protections for Australian privacy when we're talking about what are effectively private communications and private file storage [1].
Lord said Google believes it's important that people have an express and recognized right to privacy, particularly when discussing potentially intrusive monitoring within private communications or file storage. The bill instructs companies to consider factors such as security and whether actions are proportionate to risk, but does not mention privacy, and states that the cost of implementing the measures is not to be considered [1].
The government has also argued the digital duty of care enhances the Online Safety Act by putting the onus on big tech to prevent harm before it occurs [3].
The provision at issue requires companies to use at least two age-verification methods where it is technically feasible and reasonably practicable and to prevent users not verified as adults from accessing the material. It applies to any online service where there is a reasonably foreseeable risk that a child could come across pornography or fetish material, and it contains no exemption for email or messaging services [1].
The bill has drawn formal objections from the U.S. government, which raised serious concerns about aspects of the legislation relating to speech and platform design and warned that the law risks viewpoint-based censorship [4]. White House spokesman Kush Desai told the Financial Review that President Donald Trump had unequivocally warned trading partners against imposing digital services taxes, fines, and other forms of extortion on America's leading technology sector [5].
Senator Henderson said the categories of material the bill seeks to ban or restrict are too broad and could limit legitimate debate.
TikTok's Jessika Lofstedt told the inquiry the bill replaced certainty with ambiguity and with subjectivity and warned that platforms may over-moderate contentious content to avoid penalties. Google and Meta made similar observations, saying the bill lacked clarity on which recommender systems are regulated and what new powers the eSafety Commissioner may create, according to testimony.
Dany Elachi, founder of the Heads Up Alliance, told the Senate the bill was ideologically driven and could be weaponized. Daniel Wild and Dr. Andrew Bushnell of the Institute of Public Affairs said podcasters are likely to be caught up in what the think tank calls a censorship machine, and Bushnell said Section 25F's exclusion for professional news material rests on a false distinction. The Institute of Public Affairs has separately published research finding that the digital duty of care would grant the eSafety Commissioner sweeping powers as an enforcement body under the Privacy Act 1988, including authority to collect sensitive information of Australian internet users and share identifying data with overseas enforcement agencies [6].